The Linux kernel SMB client contains a double‑free bug in the SMB2_ioctl() replay logic where a response buffer is freed twice after a failed initialization attempt, causing a kernel memory corruption that can trigger a panic or enable arbitrary code execution. This kernel‑level flaw provides an attacker the opportunity to gain elevated privileges or crash the system.

The vulnerability resides in the generic Linux kernel SMB client and affects any distribution running a kernel that has not incorporated the commit 0be4bc64882edaefaaee8d1e27d083643eb778e6 or subsequent merges. Administrators should verify whether their running kernel version contains this security fix and schedule an update if necessary.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of less than 1 % and the absence from the CISA KEV catalog suggest that widespread exploitation is currently unlikely. An attacker who can drive SMB2 ioctl requests—either remotely as a SMB client or locally by accessing SMB services—could trigger the double‑free, potentially causing a denial‑of-service or achieving privilege escalation. Based on the description, it is inferred that the likely attack vector is remote SMB traffic, although local exploitation is possible if SMB support is enabled on the host.